"""Content-analysis API: results, counts, and the analysis job.

The privacy gate lives in AnalysisService: enqueuing only ever targets confirmed-SFW
assets, and the handler re-checks the gate per item, so an NSFW asset can never reach
the provider even if its decision changes between enqueue and run.
"""

from __future__ import annotations

from fastapi import APIRouter, Request
from fastapi.responses import JSONResponse

from photo_pipeline.jobs.domain_handlers import ANALYSIS, LIBRARY_WRITE_LOCK
from photo_pipeline.services.analysis import AnalysisService
from photo_pipeline.services.jobs import JobBlocked, JobService

router = APIRouter(tags=["analysis"])


def _service(request: Request) -> AnalysisService:
    return AnalysisService(request.app.state.session_factory)


def _error(status: int, code: str, message: str) -> JSONResponse:
    return JSONResponse(status_code=status, content={"error": {"code": code, "message": message}})


@router.get("/analysis/counts")
def counts(request: Request) -> dict:
    return _service(request).counts()


@router.get("/analysis/results/{asset_id}")
def result(asset_id: str, request: Request):
    data = _service(request).get(asset_id)
    if data is None:
        return _error(404, "not_found", f"no analysis for {asset_id}")
    return data


@router.post("/analysis/jobs")
def enqueue_analysis(request: Request):
    ids = _service(request).eligible_asset_ids()
    if not ids:
        return _error(409, "nothing_eligible", "no confirmed-SFW assets ready for analysis")
    jobs = JobService(request.app.state.session_factory)
    try:
        return jobs.enqueue(ANALYSIS, lock=LIBRARY_WRITE_LOCK, items=ids)
    except JobBlocked as error:
        return _error(409, error.code, str(error))